Detecting and Preventing Malware Attacks Using Simulated Analytics and Continuous Authentication

Abstract

Aspects of the disclosure relate to detecting and preventing malware attacks using simulated analytics and continuous authentication. An application server may receive device information and processing capabilities information of a client device. Based on the device information and the processing capabilities information, the application server may generate analytical output data indicating, for each transaction executed on the client device, a transaction processing time. The application server may receive transaction information associated with a transaction being executed at the client device. Based on the received transaction information and the analytical output data, the application server may simulate the transaction being executed at the client device and determine expected payload data. The application server may receive an authorization request including actual payload data associated with the transaction being executed at the client device. The application server may compare the expected payload data with the actual payload data and send an authorization response.

What is claimed is: 
     
         1 . A system comprising:
 a client device;   an application server; and   an application interface therebetween, wherein the application server is configured to:   receive, via the application interface, device information of the client device;   receive, via the application interface, processing capabilities information of the client device;   based on the device information and the processing capabilities information, generate analytical output data indicating, for each transaction executed on the client device, a transaction processing time;   receive transaction information associated with a transaction being executed at the client device;   based on the received transaction information and the analytical output data, simulate the transaction being executed at the client device;   determine expected payload data based on the simulation;   receive an authorization request, wherein the authorization request includes actual payload data associated with the transaction being executed at the client device;   compare the expected payload data with the actual payload data; and   based on the comparison, send an authorization response.   
     
     
         2 . The system of  claim 1 , wherein the processing capabilities of the client device are determined by executing simulated processing of one or more types of transactions at the client device during an enrollment process. 
     
     
         3 . The system of  claim 1 , wherein the analytical output data comprises a graphical visualization representing results of a simulated process. 
     
     
         4 . The system of  claim 1 , wherein simulating the transaction being executed at the client device comprising simulating transaction steps of the transaction based on the device information and the processing capabilities information of the client device. The system of  claim 1 , wherein receiving the device information of the client device comprises receiving information related to one or more of: a device type, a vendor name, a model name or number, a firmware version, a product name, a device identifier, or a processor identifier. 
     
     
         6 . The system of  claim 1 , wherein sending the authorization response comprises sending a message indicating whether the transaction is approved or denied. 
     
     
         7 . The system of  claim 1 , wherein sending the authorization response comprises sending a notification indicating presence of malware. 
     
     
         8 . The system of  claim 1 , wherein receiving transaction information associated with the transaction being executed at the client device comprises receiving information indicative of a transaction type. 
     
     
         9 . The system of  claim 1 , wherein the application server is further configured to:
 transmit the analytical output data for storage in one or more database tables. The system of  claim 1 , wherein simulating the transaction being executed at the client device comprises using a virtual representation of the client device.   
     
     
         11 . The system of  claim 1 , wherein the transaction being executed at the client device comprises a transaction initiated on the client device via a mobile application. 
     
     
         12 . A method comprising:
 at a computing platform comprising at least one processor, a communication interface, and memory:   receiving, by the at least one processor, via the communication interface, device information of a client device;   receiving, by the at least one processor, via the communication interface, processing capabilities information of the client device;   based on the device information and the processing capabilities information, generating, by the at least one processor, analytical output data indicating, for each transaction executed on the client device, a transaction processing time;   receiving, by the at least one processor, transaction information associated with a transaction being executed at the client device;   based on the received transaction information and the analytical output data, simulating, by the at least one processor, the transaction being executed at the client device;   determining, by the at least one processor, expected payload data based on the simulation;   receiving, by the at least one processor, an authorization request, wherein the authorization request includes actual payload data associated with the transaction being executed at the client device;   comparing, by the at least one processor, the expected payload data with the actual payload data; and   based on the comparison, sending, by the at least one processor, an authorization response.   
     
     
         13 . The method of  claim 12 , wherein the processing capabilities of the client device are determined by executing simulated processing of one or more types of transactions at the client device during an enrollment process. 
     
     
         14 . The method of  claim 12 , wherein the analytical output data comprises a graphical visualization representing results of a simulated process. The method of  claim 12 , wherein simulating the transaction being executed at the client device comprising simulating transaction steps of the transaction based on the device information and the processing capabilities information of the client device. 
     
     
         16 . The method of  claim 12 , wherein receiving the device information of the client device comprises receiving information related to one or more of: a device type, a vendor name, a model name or number, a firmware version, a product name, a device identifier, or a processor identifier. 
     
     
         17 . The method of  claim 12 , wherein sending the authorization response comprises sending a message indicating whether the transaction is approved or denied. 
     
     
         18 . The method of  claim 12 , wherein sending the authorization response comprises sending a notification indicating presence of malware. 
     
     
         19 . The method of  claim 12 , wherein receiving transaction information associated with the transaction being executed at the client device comprises receiving information indicative of a transaction type. One or more non-transitory computer-readable media storing instructions that, when executed by a computing platform comprising at least one processor, a communication interface, and memory, cause the computing platform to:
 receive, via the communication interface, device information of a client device;   receive, via the communication interface, processing capabilities information of the client device;   based on the device information and the processing capabilities information, generate analytical output data indicating, for each transaction executed on the client device, a transaction processing time;   receive transaction information associated with a transaction being executed at the client device;   based on the received transaction information and the analytical output data, simulate the transaction being executed at the client device;   determine expected payload data based on the simulation;   receive an authorization request, wherein the authorization request includes actual payload data associated with the transaction being executed at the client device;   compare the expected payload data with the actual payload data; and   based on the comparison, send an authorization response.